gitproxy/RTLPlayground
1
0
Fork 0
mirror of https://github.com/logicog/RTLPlayground.git synced 2026-09-02 15:02:51 +08:00
Code Issues Packages Projects Releases Wiki Activity

httpd: saturate parse_short() instead of wrapping

Browse Source 
The digit loop accumulated into a uint16_t without a bound, so a query
such as /vlan.json?vid=65540 read as VLAN 4 and every consumer saw a small,
valid-looking number for an out-of-range one. Clamp the result at 0xffff
once another digit would overflow (6552 * 10 + 9 is the last value that
fits). The consumers already reject or mask 0xffff: vlan_get() refuses
anything from 4095 up, send_l2() masks the index to the table size, and
l2_delete() masks the high byte.
This commit is contained in:
bloqaudio
2026-09-01 14:52:09 -05:00
parent 2499d116a3
commit d6bf46595a
1 changed files with 4 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
httpd/httpd.c
+3
View File
@@ -231,6 +231,9 @@ uint8_t parse_short(__xdata uint8_t *p)
c = *p++ - '0'; c = *p++ - '0';
if (c > 9) { break; } if (c > 9) { break; }
err = 0; err = 0;
if (short_parsed > 6552)
short_parsed = 0xffff;
else
short_parsed = (short_parsed * 10) + c; short_parsed = (short_parsed * 10) + c;
} }
return err; return err;